I got a call from my company's Google Suite administrator that they got an alert about my phone (a Samsung S10 running Android 10) getting rooted this morning.
Google's support site isn't really helpful with this, stating only that they consider my device compromised because it's rooted.
All additional information I got about the alert is:
Summary: An Android device was rooted. (Device ID xxxxxxxxxxxxxxxx)
Date: Feb 12, 2020, 09:23 AM CET (2020-02-12T09:23:17+01:00)
Device owner: firstname.lastname@example.org
As I'm pretty sure that I didn't root my company phone (especially not this morning, I was in a meeting). As I understand some apps installed can (?) root my phone, but I also don't have apps installed from untrusted sources, and I didn't install any apps in the last two days even from Google Play.
I also tried it with Root Checker, and it seems like that the phone is not rooted.
The SafetyNet Test status is
- Basic Integrity: Success
- CTS Profile Match: Success
- Response Signature Verification: Success
Is there a way that I can check on my phone what exactly causes Google to think that the device is compromised / rooted?